Why is heap spraying called spraying the heap?

Why is heap spraying called spraying the heap?

Heap Spraying. Heap spraying is a technique used to aid the exploitation of vulnerabilities in computer systems. It is called “spraying the heap” because it involves writing a series of bytes at various places in the heap – the large pool of memory that is allocated for use by programs.

What does heap spraying do to the memory?

Heap spraying is an exploitation technique that increases the exploitability of memory corruption vulnerabilities. Allocation of many objects (“blocks”) containing malicious code (+ NOP sled) in the heap. Increasing the attacker’s chance to jump to a location within the heap, successfully executing malicious code.

When was the first heap spray exploit written?

It was originally documented by Skylined and blazed a long time ago. According to Wikipedia, the first public use of heap sprays were seen in 2001 (MS01-033). Skylined used the technique in his IFRAME tag buffer exploit for Internet Explorer in 2004.

Can you use JavaScript to spray the heap?

It has scripting support, so you can use javascript or vbscript to allocate something in memory before triggering a bug. The concept of heap spraying is not limited to browsers however. You could, for example, also use Javascript or Actionscript in Adobe Reader to put your shellcode in the heap at a predictable address.

How is heap spraying similar to wall painting?

The heap is a large pool of memory that is allocated for use by programs. The basic idea is similar to spray painting a wall to make it all the same color. Like a wall, the heap is “sprayed” so that its “color” (the bytes it contains) is uniformly distributed over its entire memory “surface.”

How are Heap sprays used in the operating system?

Heap sprays take advantage of the fact that on most architectures and operating systems, the start location of large heap allocations is predictable and consecutive allocations are roughly sequential. This means that the sprayed heap will roughly be in the same location each and every time the heap spray is run.